In a telecommunications network, a switch is a device that channels incoming data from any of a plurality of input ports to at least one output port that will communicate the data toward its intended destination. In the traditional circuit-switched telephone network, one or more switches are used to set up a dedicated temporary connection or circuit for an exchange between two or more parties. On an Ethernet local area network (LAN), a switch determines which output port to forward a particular packet frame based on the medium access control (MAC) address of the received packet frame. In a packet switched IP network, a switch may determine which output port to use to route the network packet based on the IP address of each packet.
Various software algorithms and applications have been developed to discover the topology of a network and detect the presence of loops in a network. Whenever a loop is detected, the traffic on those ports that form the loop may be blocked. A blocked port may not be used to forward traffic since it would result in the forwarded traffic being looped back and subsequently received at the output port from which it was communicated. Standardized protocols such as spanning tree and rapid spanning tree are utilized to detect and prevent occurrences of loops within a network. Such methods for detecting and preventing loops may be referred to as active methods.
A loop generally creates a high concentration of traffic, which excludes other applications from communicating data over the input and output ports that form the loop. If a sufficient amount of switch ports are placed in a loop, this may render the switch inoperable. This may occur in instances where traffic in a loop is also being broadcasted to other ports and may reduce those portions of a network that is served solely by the switch.
A service provider, for example, a server, a print server, a file server and/or an email server that possesses finite resources may be subject to attacks such as denial-of-service (DoS). A distributed denial of service (DDoS) is a popular format in which a potentially large number of compromised machines may be utilized to launch an attack on a server. In a DoS attack, an attacker attempts to force a service provider to allocate resources in a wasteful manner such that legitimate clients are denied service. When a machine or device is connected to a network, transport control protocol (TCP) may be utilized to launch DoS attacks. For example, using TCP, an illegitimate client may establish multiple connections with a server or compromise an intermediary device by requesting the intermediary device to demand a connection to the server. By establishing multiple connections, the illegitimate client may consume server resources that may otherwise be utilized to service legitimate clients, such as running applications or manage network connections. As a result, new legitimate requests may be denied as the server runs out of available resources.
Typical server resources that are attacked may include central processing unit (CPU) bandwidth or CPU power, memory, disk space, network connections, network bandwidths, and quality of service (QoS). In general, service providers strive to identify attacks before they take a toll and disrupt service to legitimate clients. An example of a mitigation scheme for a denial of service attack using connection setup requests is that in some communication systems, a server may place a connection on a “potential open” list without committing its resources until a client commits its own resources later in the connection open process. The consumption of resources on the client side, in order to launch attacks against the server, may limit the number of attacks it may launch against the server.
Some attacks may create a surge of TCP connection setup requests in order to deplete server resources. Since a server consumes resources whenever a connection is accepted, generating a plurality of TCP connection setup request may rapidly deplete server resources. Although a server may have enough resources to simultaneously support, for example, about 10,000 connections, any connection consumed by an attacker may result in a denial of a legitimate connection request. Furthermore, as the number of requested connections increase, the likelihood of denial of service to a legitimate client also significantly increases. Even if an illegitimate connection is not eventually established, an illegitimate connection request consumes valuable CPU bandwidth and memory resources for processing the request, and this may steal resources, which may be better utilized for servicing legitimate requests.
Another popular mode for launching an attack may involve transmitting Internet control message protocol (ICMP) packets at an excessive rate to a server. This may require the server to respond by, for example, transmitting ICMP echo or ping messages. The ICMP is a layer 3 protocol that is integrated with the transport control protocol/Internet protocol (TCP/IP) protocol suite. It allows routers to send error and control messages about packet processing on IP networks. For example, if a packet cannot reach its destination, an ICMP message may be sent to the packet's source to inform it that the packet has not reached its destination. The ICMP messages may report congestion when a router's buffer is full and is unable to properly forward packets. A source quench message may be returned to the data source to slow down packet transmission. Troubleshooting information may also be relayed through an ICMP's echo feature. The ping utility is provides the capability to send a packet roundtrip between hosts.
In instances where a significant amount of ICMP messages are sent at a high rate, the server resources may be consumed to process the ICMP requests and to respond to these requests. If enough resources are consumed, this may eventually result in the denial of service to a legitimate client. A server that processes requests from illegitimate clients wastes resources that may otherwise be reserved and/or utilized by legitimate clients. It is critical to stop these attacks before they affect critical server resources and significantly degrade system performance.
An organization may have an internal network protected from the external world by a firewall, for example. An attack from outside an organization may employ more machines with larger number of different IP addresses than an attack using compromised internal machines that may belong to few subnets. A few machines may be compromised by external or internal attackers, for example, by guessing or stealing passwords that may lead to a large scale attack of internal machines. Such an attack may, in some cases, be limited to a single or few IP subnets, as many machines may be deployed on the same subnet. The filtering required to identify potential attackers may be simplified, once the source of the attack has been identified as relating to these IP subnets. However, each individual attack may be different. For example, attacks may be from a spoofed source IP address and accordingly, the attack may not be found by searching for that repeated address.
An attack may be repetitive in which the same source may try to launch the same attack. The attack may be prevented in the future by knowing the source and blocking it. Another attack type may be from the same source but may address different services, for example, HTTP port, FTP port. An attack may be launched from different source addresses making the learning process difficult, as the server may not be able to identify the attack by its source address alone. The learning process may include identifying the existence of an attack and then identifying the root cause of its source or mechanism.
Further limitations and disadvantages of conventional and traditional approaches will become apparent to one of skill in the art, through comparison of such systems with some aspects of the present invention as set forth in the remainder of the present application with reference to the drawings.